IAM (Identity and Access Management) is the set of tools and policies that decide who or what may access which resources. In cloud platforms such as AWS, Azure and Google Cloud, IAM defines identities (users, groups, roles, service accounts) and the permissions attached to them.
Why it matters
Almost every cloud breach story involves permissions that were too wide or credentials that were leaked. IAM is how you enforce least privilege, give applications temporary credentials instead of permanent keys, and keep an audit trail of who did what. It controls access to the cloud management plane and to the data inside services.
Example
An AWS-style policy that lets an application read objects from one bucket only:
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-assets/*"
}Anything not explicitly allowed is denied, and an explicit deny overrides an allow.
Common mistakes
- Granting wildcard permissions such as
*:*because it is quicker than finding the exact action. - Using the root or owner account for daily work instead of individual roles with multi-factor authentication.
- Committing long-lived access keys into a code repository.
- Never reviewing unused roles, which accumulate over time.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.